Linux Kernel Vulnerability in Netfilter's Synproxy Object Handling

CVE-2025-40206

What is CVE-2025-40206?

A vulnerability in the Linux kernel's netfilter component allows for unexpected behavior when referencing synproxy stateful objects within the OUTPUT hook. This error can lead to kernel crashes due to infinite recursive calls, compromising system stability. If an attempt is made to utilize a synproxy object without proper validation, an operational error is returned. Fixes have been implemented to enforce validation for synproxy object types, preventing system crashes and ensuring safe operation.

References